codeant-ai-for-open-source[bot] commented on code in PR #33924:
URL: https://github.com/apache/superset/pull/33924#discussion_r3707523402
##########
docs/admin_docs/configuration/sql-templating.mdx:
##########
@@ -372,6 +372,57 @@ Here's a concrete example:
WHERE country_code = 'US'
```
+**Guest User Attributes**
+
+The `{{ get_guest_user_attribute('attribute_name') }}` macro returns a
specific attribute value from the guest user context.
+This is useful when working with embedded Superset where guest tokens can
contain custom attributes that need to be
+accessed in SQL queries.
+
+This macro only works when the current user is a guest user (authenticated via
guest token). If the current user is
+not a guest user, or if the specified attribute doesn't exist, the macro will
return `None` or the provided default value.
+
+If you have caching enabled in your Superset configuration, then by default
the resolved value (whether it
+came from the guest token, a null attribute, or the provided default) will be
used by Superset when
+calculating the cache key. A cache key is a unique identifier that determines
if there's a cache hit in the
+future and Superset can retrieve cached data. Including the resolved value on
every branch ensures two guests
+whose tokens render different SQL never share a cache entry.
+
+You can disable the inclusion of the attribute value in the calculation of the
+cache key by adding the following parameter to your Jinja code, but only do so
+when the value cannot affect the query results:
+
+```
+{{ get_guest_user_attribute('department', add_to_cache_keys=False) }}
+```
+
+You can also provide a default value if the attribute is not found:
+
+```
+{{ get_guest_user_attribute('region', default='US') }}
+```
+
+Here's a concrete example of using guest user attributes in a query:
+
+```sql
+SELECT *
+FROM sales_data
+WHERE region = '{{ get_guest_user_attribute("user_region", default="global")
}}'
+ AND department = '{{ get_guest_user_attribute("department") }}'
+```
+
+:::warning[Security Warning]
+
+Guest token attributes come from the embedding application. By default,
+`get_guest_user_attribute()` escapes string values — including strings nested
inside
+arrays and object values, and caller-supplied defaults — through the database
dialect's
+literal rendering (the same mechanism as `url_param()`). This covers
dialect-specific
+escape characters such as the backslash on MySQL/MariaDB, so the example above
is safe
+to interpolate directly. If you pass `escape_result=False`, or interpolate
non-string
+values (numbers, booleans), you are responsible for validating or allowlisting
the
+values, since they originate outside Superset.
Review Comment:
**Suggestion:** The security warning overstates the safety of directly
interpolating array and object attributes. Although nested values are escaped,
the macro returns Python list/dict structures whose rendered representation is
not a portable SQL literal, and object keys are not escaped by the
implementation. Document supported SQL usage explicitly or require callers to
serialize and validate structured values before interpolation. [security]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Structured guest attributes can produce invalid, non-portable SQL.
- ❌ Unescaped object keys can break SQL interpolation.
- ⚠️ Embedded dashboard authors may rely on misleading safety guidance.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=a995f28448504d209075bfe56ec57633&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=a995f28448504d209075bfe56ec57633&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** docs/admin_docs/configuration/sql-templating.mdx
**Line:** 415:422
**Comment:**
*Security: The security warning overstates the safety of directly
interpolating array and object attributes. Although nested values are escaped,
the macro returns Python list/dict structures whose rendered representation is
not a portable SQL literal, and object keys are not escaped by the
implementation. Document supported SQL usage explicitly or require callers to
serialize and validate structured values before interpolation.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F33924&comment_hash=77720343455099e1f4aa6f829cecf07fed1fbdc5d6f8e21c5232e92da7017959&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F33924&comment_hash=77720343455099e1f4aa6f829cecf07fed1fbdc5d6f8e21c5232e92da7017959&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
